# Authentication

> API keys, how to send them and what limits they carry.

Section: Get started. Web page: https://www.launchables.ai/docs/authentication

Every request to `POST /v1/decide` carries your API token as a bearer token. `GET /health` and `GET /v1/models` need no token.

```
Authorization: Bearer launchables_...
```

## Getting a token

Create tokens yourself in the [console](https://console.launchables.ai). Every key belongs to a workspace: sign in, open Workspaces, choose one, then open API keys and create a key. The full token is shown once, and an organisation can hold up to 25 active keys. See [Console](https://www.launchables.ai/docs/console) for workspaces, roles and credit. Revoke a key there and the API refuses it within a minute. On your own hardware, tokens are issued by whoever runs the endpoint.

## Credit and limits

Hosted keys work once your account has prepaid credit, bought in the [console](https://console.launchables.ai) from £5. When the credit runs out, every key on the account pauses and answers `402` with type `out_of_credit` until you top it up. Automatic top-up keeps them running.

A workspace can also limit its keys. When its monthly budget is reached, they answer `402` with type `budget_exceeded`. A model the workspace may not use answers `403` with type `model_not_allowed`. Every code is listed in [Errors and limits](https://www.launchables.ai/docs/api/errors).

By default each key can make 1,200 requests a minute, with no daily cap. A workspace can set its own per-key limit. Going over returns `429`; wait and retry. [Ask us](https://www.launchables.ai/contact?about=api) if you need a higher limit.

## When a token is refused

A missing, wrong, expired or revoked token returns `401` with an error body:

```json
{ "error": "missing or invalid API key" }
```

## Keeping tokens safe

- Keep tokens on your server, in an environment variable or a secret store. Never put one in a web page or a mobile app.
- Use a separate token for each environment, so one can be revoked without stopping the others.
- If a token leaks, [tell us](https://www.launchables.ai/contact?about=security) and we will revoke it and issue a new one.